feat: finish the ai plugin (B18)

plugins/snippets/src/backend/index.ts

@@ -91,6 +91,15 @@ export async function activate(ctx: PluginContext) {
     return repo.findAccessibleSharedSnippet(id, userId, roleIds);
   }
 
+  // The service is gated on snippets.view; a write also needs the same
+  // permission its route requires, so a caller cannot write through here
+  // what the user could not write in the panel.
+  async function requirePermission(permission: string): Promise<void> {
+    if (!(await ctx.rbac.has(permission))) {
+      throw new Error(`Missing permission snippets.${permission}`);
+    }
+  }
+
   const service: SnippetsService = {
     list: async () => {
       const userId = ctx.currentActor();
@@ -127,18 +136,21 @@ export async function activate(ctx: PluginContext) {
     create: async (input) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.create needs an actor");
+      await requirePermission("create");
       const created = await repo.createSnippet(userId, input);
       return { id: created.id, name: created.name };
     },
     update: async (id, changes) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.update needs an actor");
+      await requirePermission("edit");
       const result = await repo.updateSnippet(userId, id, changes);
       if (!result) throw new Error("Snippet not found");
     },
     remove: async (id) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.remove needs an actor");
+      await requirePermission("delete");
       const existing = await repo.deleteSnippet(userId, id);
       if (existing?.syncId) {
         await ctx.sync.recordTombstone(userId, "snippets", existing.syncId);

plugins/snippets/src/frontend/index.tsx

@@ -76,6 +76,14 @@ export function activate(app: TermixApp): void {
       : null;
   }) as never);
 
+  // For pickers in other plugins (the AI assistant's @-mentions): id and name.
+  app.registerAction("snippets.list", (async () => {
+    const snippets = await createSnippetsApi(app.api)
+      .list()
+      .catch(() => []);
+    return snippets.map((snippet) => ({ id: snippet.id, name: snippet.name }));
+  }) as never);
+
   app.registerAction("snippets.execute", (async (
     snippetId: number,
     hostId: number,